untag built image after push to bound the dind image store

image-build loads each build into the runner pod's dind (load: true); the
tags then accumulated forever (dozens of stale 2-3GB tags per pod, a chunk
of the runner disk growth). Untag after a successful push and sweep the
now-dangling previous :latest. The buildkit build cache is separate and
refcounts its own layers, so the next build stays warm; when the repo is
'runner' itself the pod's next job re-pulls the ~380MB job image from the
local registry (cheap). Guarded (continue-on-error + || true) so cleanup
never fails a release.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

action.yaml

@@ -83,3 +83,29 @@ runs:
               echo "deleting ${NAME}:$tag"
               tea api -X DELETE "/packages/${ORG}/container/${NAME}/${tag}"
             done
+
+    - name: Untag local image
+      # image-build loads the built image into the runner's dind (load: true).
+      # Nothing needs the local tag after the push, but the tags used to pile up
+      # forever in the pod's dind image store (dozens of stale 2-3GB tags). Untag
+      # after pushing to reclaim the store; the buildkit BUILD cache is separate
+      # and refcounts its own layers, so the next build of this image is still
+      # warm. (When THIS repo is `runner`, untagging :latest costs the pod's next
+      # job one ~380MB re-pull of the job image from the local registry — cheap.)
+      # The image prune sweeps the now-dangling previous :latest that a re-tag
+      # orphans; it only removes untagged images no container/tag references, so
+      # shared layers survive.
+      continue-on-error: true
+      shell: bash
+      env:
+        IMAGE: ${{ inputs.image }}
+        TAG_INPUT: ${{ inputs.tag }}
+        RUN_NUMBER: ${{ github.run_number }}
+        LATEST: ${{ inputs.latest }}
+      run: |
+        TAG="${TAG_INPUT:-$RUN_NUMBER}"
+        docker rmi "${IMAGE}:${TAG}" || true
+        if [ "$LATEST" = "true" ]; then
+          docker rmi "${IMAGE}:latest" || true
+        fi
+        docker image prune -f || true